技術標籤：資料庫ClickHouse

我們安裝好Click house後都是通過default使用者登入，如果想自己實現自定義的使用者許可權控制管理就要詳細讀懂users.xml文件，我翻譯出來了：

<users>
        <!-- If user name was not specified, 'default' user is used.如果使用者名稱沒有特別指定，預設使用default使用者 -->
        <default>
            <!-- Password could be specified in plaintext or in SHA256 (
 
in hex format).密碼可以明文形式指定或者使用SHA256加密形式
                 If you want to specify password in plaintext (not recommended), place it in 'password' element.
		如果你自定義明文密碼，寫在password標籤中間即可
                 Example 例如: <password>qwerty</password>.
                 Password could be empty. 密碼可以為空
                 If you want to specify SHA256,
 
 place it in 'password_sha256_hex' element.
		如果你想使用SHA256加密形式，把加密後的密碼放在password_sha256_hex標籤中間
                 Example例子: <password_sha256_hex>65e84be33532fb784c48129675f9eff3a682b27168c0ea744b2cf58ee02337c5</password_sha256_hex>
                 Restrictions of SHA256: impossibility to connect to ClickHouse using MySQL JS client (
 
as of July 2019).
		SHA256的限制：無法使用MySQL JS客戶端連線到ClickHouse
                 If you want to specify double SHA1, place it in 'password_double_sha1_hex' element.
		如果你想自定義雙重SHA1加密，把密碼放在password_double_sha1_hex標籤中間即可
                 Example例子: <password_double_sha1_hex>e395796d6546b1b65db9d665cd43f0e858dd4303</password_double_sha1_hex>
                 If you want to specify a previously defined LDAP server (see 'ldap_servers' in main config) for authentication, place its name in 'server' element inside 'ldap' element.
		如果你想指定提前定義好的輕量級目錄訪問協議（LDAP，請參閱住配置中的LDAP服務）服務來進行授權和驗證，把名稱放在 <ldap><server>兩個標籤中間
                 Example例如: <ldap><server>my_ldap_server</server></ldap>
                 How to generate decent password: 如何生成符合規則的密碼
                 Execute執行: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-'
                 In first line will be password and in second - corresponding SHA256.第一行是密碼，第二行是對應的SHA256加密後的
                 How to generate double SHA1:如何生成雙重SHA1加密
                 Execute執行: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha1sum | tr -d '-' | xxd -r -p | sha1sum | tr -d '-'
                 In first line will be password and in second - corresponding double SHA1.第一行是密碼，第二行是對應的雙重SHA1加密後的
            -->
            <password>123456</password>

            <!-- List of networks with open access.網路連線開放列表
                 To open access from everywhere, specify: 開放所有連結，定義：
                    <ip>::/0</ip>
                 To open access only from localhost, specify: 只對本地連線開放，定義：
                    <ip>::1</ip>
                    <ip>127.0.0.1</ip>
                 Each element of list has one of the following forms: 列表的每個標籤都具有以下格式：
                 <ip> IP-address or network mask IP地址或者子網掩碼. Examples: 213.180.204.3 or 10.0.0.1/8 or 10.0.0.1/255.255.255.0
                     2a02:6b8::3 or 2a02:6b8::3/64 or 2a02:6b8::3/ffff:ffff:ffff:ffff::.
                 <host> Hostname. Example: server01.yandex.ru. 主機名稱，例如：（配置你自己的主機名稱）
                     To check access, DNS query is performed, and all received addresses compared to peer address.
                 <host_regexp> Regular expression for host names. Example, ^server\d\d-\d\d-\d\.yandex\.ru$
                     To check access, DNS PTR query is performed for peer address and then regexp is applied.
			為了檢查訪問，執行DNS查詢，並將所有接收到的地址與對等地址進行比較
                     Then, for result of PTR query, another DNS query is performed and all received addresses compared to peer address.
			然後，對於PTR查詢的結果，執行另一個DNS查詢，並將所有接收到的地址與對等地址進行比較
                     Strongly recommended that regexp is ends with $  強烈建議regexp以$結尾
                 All results of DNS requests are cached till server restart.  所有的DNS請求解析結果都會被快取起來直到下一次click house服務重啟
            -->

            <networks incl="networks" replace="replace">
                <ip>::/0</ip>
            </networks>

            <!-- Settings profile for user. -->
            <profile>default</profile>

            <!-- Quota for user. -->
            <quota>default</quota>

            <!-- User can create other users and grant rights to them. 使用者可以建立其他使用者並且授予許可權 1 啟動 0 禁止—>
            <!-- <access_management>1</access_management> -->
</default>

<!-- 自定義使用者 :密碼123456，允許所有外部連結，連線資料庫test，只讀許可權， 配額使用預設配額資訊—>
<jojo>
	<password>123456</password>
	<networks incl="networks" replace="replace">
                <ip>::/0</ip>
         </networks>
	<allow_databases>
		<databse>test</database>
	</allow_databases>
	<profile>readonly</profile>
         <quota>default</quota>
</jojo>

</users>

配置檔案說得很詳細了，仔細看都能看懂，可以看到我自己配了個只讀許可權的jojo使用者。如果是讀寫都開放那就是：改成default，還能通過

 DB::Exception: Received from 127.0.0.1:9000. DB::Exception: jojo: Authentication failed: password is incorrect or there is no user with such name.

該配置檔案最好複製default的改，自己寫很容易出問題，老是說漏一個標籤，但是檢查又檢查不出來。重啟失敗，第一件事不是去找組長或者求人，而是應該看錯誤日誌輸出，具體解決方案可以看：https://blog.csdn.net/whiteBearClimb/article/details/110952408

報錯：
2020.12.10 10:42:37.155639 [ 117297 ] {} <Error> ConfigReloader: Error loading config from '/etc/clickhouse-server/users.xml': Poco::Exception. Code: 1000, e.code() = 0, e.displayText() = SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 17, Stack trace (when copying this message, always include the lines below):
server/users.xml', line 100 column 17
2020.12.10 10:51:11.355092 [ 77357 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 17
2020.12.10 10:51:41.612965 [ 77502 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 17
2020.12.10 10:52:11.855936 [ 77586 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 17
2020.12.10 10:52:42.105438 [ 77790 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 17
2020.12.10 10:53:12.368823 [ 77869 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 17
2020.12.10 10:53:42.612247 [ 78011 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 17
2020.12.10 10:54:12.859283 [ 78169 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 23
2020.12.10 10:54:43.115143 [ 78321 ] {} <Error> Application: SAXParseException: Tag mismatch in '/etc/clickhouse-server/users.xml', line 100 column 23

反正，不要手打，好像順序問題也會導致這個問題～～

關於SHA加密，如果你電腦按照它說的輸入卻沒有出現密碼和加密後的密碼的話，報錯：

-bash: sha256sum: command not found
-bash: sha1sum: command not found

那就裝一下：

Mac系統安裝方式：brew install coreutils
Linux系統安裝：yum install perl-Digest-SHA

裝完之後再執行（記得是把下面長串貼到users.xml裡面）：

測試階段：我的jojo使用者是readonly，那就肯定是不能create database 或者table的，測試一下

先登入：clickhouse-client -u jojo -h 127.0.0.1 --password 123456

切換回default使用者：

成功～～～剩下的登入限制，查詢限制，連線限制，都可以自己DIY玩一下，都是OK的～